jaffacakes118_not-a-virus[.]HEUR[.]AdWare[.]NSIS[.]DealPly[.]gen[.]004ce8a4f1840e35fe7e380ef61910dc

resource	yara_rule
static1/unpack001/$PLUGINSDIR/md5dll.dll	acprotect
static1/unpack001/$PLUGINSDIR/nsRandom.dll	acprotect

resource	yara_rule
static1/unpack001/$PLUGINSDIR/md5dll.dll	upx
static1/unpack001/$PLUGINSDIR/nsRandom.dll	upx

resource
unpack001/$PLUGINSDIR/LangDLL.dll
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/inetc.dll
unpack001/$PLUGINSDIR/md5dll.dll
unpack002/out.upx
unpack001/$PLUGINSDIR/nsDialogs.dll
unpack001/$PLUGINSDIR/nsRandom.dll
unpack003/out.upx

resource
jaffacakes118_not-a-virus.HEUR.AdWare.NSIS.DealPly.gen.004ce8a4f1840e35fe7e380ef61910dc

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

jaffacakes118_not-a-virus.HEUR.AdWare.NSIS.DealPly.gen.004ce8a4f1840e35fe7e380ef61910dc

IMPHASH 7fa974366048f9c551ef45714595665e
SHA256 2e260e3302ca770b809717142421ab557617a377e6b90f9458ad31a627644687
MD5 004ce8a4f1840e35fe7e380ef61910dc
SHA1 ae1cad3c7fd90e11dab8d1b88badce1e5b59123a
SHA512 4fa6d1d481f50fbdd4eb11b56697b6b14fbe6c35ee0775256aabd501e8e5c7f48a83a02131a2a71b58b331aea59d15877c1762b141d5020d328caa1feeca4d5e
SSDEEP 6144:Ae34MvEq1zQbe9DP3lpr4jAxLY6MAEVagK:JVzQcbRx9AVP
TLSH
T1D445FB912A05EF43F3C5C832E972B9798AA13C5E1FF39875A578B9DCE5BC7601019283
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.
NSIS installer

installer

PE Signature issue

Digest

44:24:e4:d1:c3:d2:6e:28:81:ec:f6:c7:90:d6:d6:99:01:f7:5c:52

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Media Ingea SL,O=Media Ingea SL,POSTALCODE=29010,STREET=Pirandello 16\, planta 2,L=Malaga,ST=Malaga,C=ES

Chains

Oct 7, 2026

CN=Media Ingea SL,O=Media Ingea SL,POSTALCODE=29010,STREET=Pirandello 16\, planta 2,L=Malaga,ST=Malaga,C=ES

Subject

CN=COMODO Code Signing CA 2,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

10:70:9d:4f:f5:54:08:d7:30:60:01:d8:ea:91:75:bb

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Aug 24, 2011 - May 30, 2020

Subject

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Serial Number

42:1a:f2:94:09:84:19:1f:52:0a:4b:c6:24:26:a7:4b

Issuer

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Jun 7, 2005 - May 30, 2020

Subject

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Serial Number

01

Issuer

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

May 30, 2000 - May 30, 2020

Subject

CN=Media Ingea SL,O=Media Ingea SL,POSTALCODE=29010,STREET=Pirandello 16\, planta 2,L=Malaga,ST=Malaga,C=ES

Serial Number

99:42:c2:9e:c7:d5:e8:b0:f6:79:ae:00:f0:49:5b:95

Issuer

CN=COMODO Code Signing CA 2,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 2, 2012 - May 2, 2013

Minor OS version

0

Major OS version

4

Entry point

12538

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CompareFileTime SearchPathA GetShortPathNameA GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA GetLastError CreateDirectoryA SetFileAttributesA Sleep GetTickCount GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess GetWindowsDirectoryA SetFileTime GetCommandLineA SetErrorMode LoadLibraryA lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA lstrlenA lstrcatA GetSystemDirectoryA GetVersion CloseHandle lstrcmpiA lstrcmpA ExpandEnvironmentStringsA GlobalFree GlobalAlloc WaitForSingleObject GetExitCodeProcess GetModuleHandleA LoadLibraryExA GetProcAddress FreeLibrary MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA WriteFile ReadFile MulDiv SetFilePointer FindClose FindNextFileA FindFirstFileA DeleteFileA GetTempPathA

user32

EndDialog ScreenToClient GetWindowRect EnableMenuItem GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard RegisterClassA TrackPopupMenu AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA DestroyWindow CreateDialogParamA SetTimer SetWindowTextA PostQuitMessage SetForegroundWindow wsprintfA SendMessageTimeoutA FindWindowExA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA OpenClipboard ExitWindowsEx IsWindow GetDlgItem SetWindowLongA LoadImageA GetDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndPaint ShowWindow

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectA SetBkMode SetTextColor SelectObject

shell32

SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA SHGetSpecialFolderLocation

advapi32

RegQueryValueExA RegSetValueExA RegEnumKeyA RegEnumValueA RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegCloseKey RegCreateKeyExA

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

$LOCALAPPDATA/bloson.bmp

SHA256 4c96173bbf38464a389e228d2cbcc07ed0d6999febbf542a80eea8e22d2a97d3
MD5 852dd98c6793cb2083584e3d0ef70010
SHA1 245f1daf2228479a510562c368038654fbf1ef87
SHA512 8f991283f20f6954776ec4200b5c6632e3d7f9ce71147de9ffb282cf3490c902095d187b93b28a6d7aafe9d5b77ba0544f7380b58999b8da9572875fc527b522
SSDEEP 384:FuijHC1EbCjHN+5FJ8pUrw8CpRN9qPeuIe689RN1v5QNwCfwyPpQ:wi+s7S9u+tQ
TLSH
T165C2B59EC68155DB6C5D4E18C3E06825B399BFF2BD58E565A729B34C86B0098F3800FF
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

$LOCALAPPDATA/datos.txt

SHA256 18eead615a3721385f6741b70e4745de3f9e49c2090070b654da6e628187fa7d
MD5 12bf28e7bc1f14191bb579ec105f03ff
SHA1 262c664250da3123714154e07243597902cca2a3
SHA512 7bc36204f768d9509b8d507883e8f31ee4fbbd61d2885075c80e3e09ad96c48e16d70308d3e053d792822415859031a29b54b24c333564ce0c6303efb0e593f1
TLSH
T18BF097ACC328124828C2BF3C78B0A74CCC0B01CACF21D2B0CDC716AD75C0008BA574C0
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

$LOCALAPPDATA/dealply.bmp

SHA256 0f84e3d4cf457f6601c12f52ea349e803ce12730de38657651b80e6cdcb6d098
MD5 622892e1bfd696d8964c75977e538674
SHA1 fd78c36c6aee910b534d075781869eac5e96564e
SHA512 0504546af904ba9074143173e498c51977c9913733689d1a8d22357e957b4311a62b177c180150f1b8a51986e4669935973f25f3840e39710fe3c167938206a4
SSDEEP 1536:uOPffSTfV5jJcuowkQU2+breKc2ANFDPIsjt:OLYct
TLSH
T15373FC362B7DCC41B6921CA46496FB8428772E7C3C68FD0892AC374D66757660C0F9AF
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

$LOCALAPPDATA/facemoods.bmp

SHA256 7d6b6e9d5ff4b39c40b895fedf3ca1e1366f602960cb653ee89ea59b5dd811aa
MD5 1d6442c13237dcb3446f30ecc8066a48
SHA1 c9df7681d8a442000aa93401a772160fcf0d4103
SHA512 32ad14ba09c88e37ef3dded57676d45baf4c7a797e9b8921d7c54a3ce55a538f6c932d5e0d326f47b3100a980eee05fbe323a18bc422e6d4e2691613ff3b5342
SSDEEP 1536:HqCXbI0p3Ar2J3S9IRcxtVI5oBo9QqbRQ9EGnC/l:K/02r5KjAm
TLSH
T111735D921883D5A4B2762B30D7612D49C2376EF92E7BA47E2804F2DACF73DC41AB5350
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

$LOCALAPPDATA/lateral1.bmp

SHA256 e9be711645adceef7a7f55ad9b573cf67910c885ebf63024928656823079512b
MD5 09fbaede48cfedb759e640bed10d5dbf
SHA1 e1c0a5a77042595beae53955cad72143aac61045
SHA512 aeb67c0ccfea4b5c09dcbb398be9e863c3c35eb3f9cb8c8eb666e8d69fd00ac6195024e443333ce5645a04b00c38c17182533d9f8ba7312ff446f1be5cba0d28
SSDEEP 192:tLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLe:mAiUHnoQkU6KCrdD
TLSH
T1481409922A46FF43F3D5D822E876F56986A13C4F5BE39475A078BD98B2BC770500A343
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

$LOCALAPPDATA/lateral2.bmp

SHA256 ca2a72e55aa5249a9c47983f7a03dcad7509b68adcf109b7913d26c9cf2fd353
MD5 d0d2b5814833b7412a66c89e8b75021d
SHA1 9b6c821d9078aa1054f522d3669686a1f7792b37
SHA512 04e1ae6a68ac73ef37bbe799e95ee6f218b846f129ee29fb7c6f24ea2134074dc88fc038fe67b47e49d7ce0675abb61c697eb54c6d67ac4b88984fefbefef141
SSDEEP 192:tLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLT:CcAiUHnoQkU6KCrdD
TLSH
T1121409922A46FF43F3D5D822E876F56986A13C4F5BE39475A078BD98B2BC770500A343
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

$LOCALAPPDATA/lateral3.bmp

SHA256 6b9ca40f2943ce7ca4585cf1d0dda3cef8c96b305a6eb1f4df2686bf10c842ec
MD5 e1ce13e6f1ed1f339f8595ccf9d0198e
SHA1 666997a9f8786074193c6cb2160c2ef3962d3ecc
SHA512 6eb991deee612f18635d84d9d889388e4c8f9d9cd7021bd05a1dce480d067733d7da77c2da96c536ac39abc826188123fabdf3a21ee7da515d2d01a9f97c18f7
SSDEEP 192:mWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWW2:RGjOTJthkj6K2rQe
TLSH
T1571409922A46FF43F3D5D822E876F56986A13C4F5FE39475A078BD99B2BC770100A243
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

$LOCALAPPDATA/save_en.bmp

SHA256 c8af686faa44b1d9693a4f5aa0e1abc880e2bf75906f6c4dfcf60ccd87ceb153
MD5 415d20830ecd308d3af4a83209dfd3fb
SHA1 b3fd0de9252edaec00fb52836f5241f1d843d7f9
SHA512 f123daa815fc3821220c899028f8c6b4b8f2d324d53a42f9ddb55489236379264831b364c6b5bc850f81fd8a245581d7edf10df4b6c4294d1cba5954192e7f9b
SSDEEP 384:c354b2rREQRMOr5WK8nggvxJlhgeFVi7VZU:n2rRIO8nggvxJlhghVZU
TLSH
T18C13069CAA0DCD6906C3DE5A0272872EACB535D84A207E8DCF3FBE45CEA40C251D59C7
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

$LOCALAPPDATA/save_es.bmp

SHA256 6ad2e8c78935d0b0e607218122c2d3e02dccd357955787c0e7188e2b21d5939a
MD5 7e0ea73191c835063a351dfc6478934a
SHA1 4ab8318d9ad0cdb21c555ee5d0c22c3060dca87d
SHA512 036d84cc7c4b8c301e6ec9b1511238959e40d40410588e144b50281325d711cf4e7fe7367ce176a922b61b1b070abb98685f9e38a9e323eebbd04fc90b09d504
SSDEEP 384:c33vkad0QYv/nBNUN3i7fBMnylwSi7VZU:daiQYvS34BYylwbVZU
TLSH
T13913079CA90DCD690AC3DE5E0272872EACB535D84A207D8DCF3BBE45CEA40C651E59C7
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

$PLUGINSDIR/LangDLL.dll

IMPHASH 9b6b6a7858e17fb0b17e1c1428330343
SHA256 60a964095af1be79f6a99b22212fefe2d16f5a0afd7e707d14394e4143e3f4f5
MD5 9384f4007c492d4fa040924f31c00166
SHA1 aba37faef30d7c445584c688a0b5638f5db31c7b
SHA512 68f158887e24302673227adffc688fd3edabf097d7f5410f983e06c6b9c7344ca1d8a45c7fa05553adcc5987993df3a298763477168d4842e554c4eb93b9aaaf
SSDEEP 48:iV6pAvmNC6iMPUptxEZK65x/AmvycNSmwVsOYJyvrpXptp/JvR0Jlof5d2:2811GED5ZTvycNSmwVsTJuftpZR0Sd2
TLSH
T129C18333B3C24AF5D6950633252373C366539E342359804F9B6712AA69208FBDD6E793
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

5526

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/System.dll

IMPHASH 2017f2acbdaa42ab3e4adeb8b4c37e7b
SHA256 dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
MD5 c17103ae9072a06da581dec998343fc1
SHA1 b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
SHA512 d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
SSDEEP 192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw
TLSH
T1CA325C5993A0C1F3D5A0823C0D973A7B1779722016B14FA3CFA35842AE196D7AC7D227
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10544

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/inetc.dll

IMPHASH e886a412cdaf11998a8eeffda508e913
SHA256 983859570099b941c19d5eb9755eda19dd21f63e8ccad70f6e93f055c329d341
MD5 1efbbf5a54eb145a1a422046fd8dfb2c
SHA1 ec4efd0a95bb72fd4cf47423647e33e5a3fddf26
SHA512 7fdeba8c961f3507162eb59fb8b9b934812d449cc85c924f61722a099618d771fed91cfb3944e10479280b73648a9a5cbb23482d7b7f8bfb130f23e8fd6c15fb
SSDEEP 384:XErRo4TdlKCdUk6qz46qu2vPqUcnlSHmkuPJOiya4fF0Ac9khYLMkIX0+GvBgK3M:XiRoW7Kc5bBq1qNlSHmkuPJOJa4f4CD
TLSH
T1E0B2A59AD600B977E3E6253072910F4247BDBF723060744BEA63277D58B52E6FA38243
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

17793

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

msvcrt

_mbschr _adjust_fdiv malloc _initterm free strlen strchr strrchr _mbsrchr strtoul memset _mbsstr strtol

kernel32

GlobalFree CreateThread WaitForSingleObject TerminateThread GetModuleHandleA MulDiv lstrcpyA GlobalAlloc LoadLibraryA GetProcAddress lstrcmpiA CreateFileA GetFileSize lstrlenA WriteFile ReadFile lstrcmpA lstrcpynA lstrcatA GetLastError DeleteFileA CloseHandle SleepEx SetFilePointer GetTickCount

user32

MessageBoxA GetParent ShowWindow SetWindowLongA IsWindow SetWindowTextA SendDlgItemMessageA GetDlgItem PostMessageA GetWindowTextA SendMessageA SetDlgItemTextA SetWindowPos SystemParametersInfoA GetClientRect GetWindowRect SetTimer LoadIconA DestroyWindow KillTimer UpdateWindow RedrawWindow DispatchMessageA TranslateMessage IsDialogMessageA GetMessageA IsWindowVisible EnableWindow CreateDialogParamA FindWindowExA wsprintfA GetWindowLongA

wininet

HttpSendRequestA HttpSendRequestExA HttpQueryInfoA FtpCreateDirectoryA FtpOpenFileA InternetGetLastResponseInfoA InternetSetFilePointer InternetSetOptionA InternetQueryOptionA InternetCloseHandle InternetErrorDlg HttpAddRequestHeadersA HttpOpenRequestA HttpEndRequestA InternetConnectA InternetCrackUrlA InternetOpenA InternetReadFile InternetWriteFile

comctl32

ord17

$PLUGINSDIR/md5dll.dll

SHA256 fbed2f1160469f42ce97c33ad558201b2b43e3020257f9b2259e3ce295317a70
MD5 0745ff646f5af1f1cdd784c06f40fce9
SHA1 bf7eba06020d7154ce4e35f696bec6e6c966287f
SHA512 8d31627c719e788b5d0f5f34d4cb175989eaa35aa3335c98f2ba7902c8ae01b23de3ccb9c6eb95945f0b08ef74d456f9f22ca7539df303e1df3f6a7e67b358da
SSDEEP 96:GL2PcvGn5olZMTZxEp8agTsflVwn4GogZcko5N1ub:U2Pxn5UZMTZipyaw4ZkKP2
TLSH
T1D3D13941ABEC226AF7BB09306BB143365076B8A0EFBAD7BE04A4014E29611400C71F39
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

ACProtect 1.3x - 1.4x DLL software

Detects file using ACProtect software.
UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

31488

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

out.upx

SHA256 79653364f46754d144e3c6db81258d8cba965aae5d9d7b66030f7535d761b585
MD5 537a21e0573b7e13469e4b1ac35bd52d
SHA1 ecdc814bde9fec1c909e1907bd2c1bbac4914f54
SHA512 5a7efdd11ac09330cc6257999d670c4cdd97ef1acf5f121278d3811f4439feed745e2e1a04e1fa62abb04ac24b2130fa6e496ef5740d7a11d00f7ad5dd5f30e8
SSDEEP 96:yX4qYlYGflug0Dvxn6GuKM9sh1gdrN9+oB7FT9I4GogZcko5N1:yXMhugRK8hlTZkKP
TLSH
T1D7F1A525A3E912ADF1FB4E71ABA3353257353D65AF23E23A1B01014B54716F4DC32B1A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

4480

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/modern-header.bmp

SHA256 ecedfdae5316b8a8529c71949cc1e0e53a3e4cbc9552ab3301ec961404185220
MD5 b94ce22e857bffbbff032d747653b3b0
SHA1 fd7ee723aefb384db149bf92a36603cfb70f4d98
SHA512 cd89199ed395ebf873712d4a41e74a8271834e8104e67adb833c8c5884d081b9b65c49d2fa902d4a15eb14dba42246486ebfd33ddf80f4ed1add6b8891b49733
SSDEEP 384:l121P4+YUzC3vygNWiWnBz+bYhDJi+u7KrEOn4VhzytFC+D:DttH/lW1Bz3Dk+x63Ga+D
TLSH
T1D9D3A2C11A44FE87F3C5C923F966BDB58AD1794F6FE38974B0ACBAC8629D9702104187
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

$PLUGINSDIR/nsDialogs.dll

IMPHASH 1e2884056e655f2b7bc5a904e352fc80
SHA256 e31ad6c6e82e603378cb6b80e67d0e0dcd9cf384e1199ac5a65cb4935680021a
MD5 c10e04dd4ad4277d5adc951bb331c777
SHA1 b1e30808198a3ae6d6d1cca62df8893dc2a7ad43
SHA512 853a5564bf751d40484ea482444c6958457cb4a17fb973cf870f03f201b8b2643be41bccde00f6b2026dc0c3d113e6481b0dc4c7b0f3ae7966d38c92c6b5862e
SSDEEP 96:hBABCcnl5TKhkfLxSslykcxM2DjDf3GE+Xv8Xav+Yx4VndY7ndS27gA:h6n+0SAfRE+/8ZYxMdqn420
TLSH
T17F12F8675A4041B3E9A3223D306A3E3F8B7C9325D0927C03C677AE566AB031A7D3A354
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

7410

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsRandom.dll

SHA256 db267d9920395b4badc48de04df99dfd21d579480d103cae0f48e6578197ff73
MD5 ab467b8dfaa660a0f0e5b26e28af5735
SHA1 596abd2c31eaff3479edf2069db1c155b59ce74d
SHA512 7d002dc203997b8a4d8ec20c92cd82848e29d746414f4a61265c76d4afb12c05bce826fc63f4d2bd3d527f38506c391855767d864c37584df11b5db9ca008301
SSDEEP 384:LCHDPMs4GdtyO5roguusMxUXiO3wOw95euooP2UgKbd9BvNtf:LCHD6Gh87MKXil/5r2U3z
TLSH
T1A3A2E1AFFA7A8B72C21162394365DDF861D08DDD01EE1E479A2EC226ACBD0400D7221B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

ACProtect 1.3x - 1.4x DLL software

Detects file using ACProtect software.
UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

68128

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

out.upx

SHA256 5e5303e06d8457a10b294fafa628e115b403569703a1ae80c416916c5ed9b08b
MD5 501650d47110eec0b72b7d73b41478f7
SHA1 eaec655c4a6d175cf152a8d533b1cf611e445c01
SHA512 0615b3d50d57f3248f66cb2532fb43c494e5c9e97d1ea288bcd74d935cf0baa9f7fea5479418a34fc3532f7fbc0692376183c36bcd31dfe84ced42da853af7d6
SSDEEP 768:oCeqBQGwr4MINuUFp6dgUL5f9sC63x2mM6TyTFIK:PeqBQgMgNbASPtTyTSK
TLSH
T120033917F6E2C030F831CBB46C38A124EA3B3D703DA4157BA7B5595D9CA56826CD83A7
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

33064

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

Name

CODE

Size

28KB

Virtual Size

28KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

DATA

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

BSS

Size

Virtual Size

1KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

512B

Virtual Size

73B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

jaffacakes118_not-a-virus.HEUR.AdWare.NSIS.DealPly.gen.004ce8a4f1840e35fe7e380ef61910dc

PE Signature issue

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

generic

$LOCALAPPDATA/bloson.bmp

$LOCALAPPDATA/datos.txt

$LOCALAPPDATA/dealply.bmp

$LOCALAPPDATA/facemoods.bmp

$LOCALAPPDATA/lateral1.bmp

$LOCALAPPDATA/lateral2.bmp

$LOCALAPPDATA/lateral3.bmp

$LOCALAPPDATA/save_en.bmp

$LOCALAPPDATA/save_es.bmp

$PLUGINSDIR/LangDLL.dll

kernel32

user32

gdi32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$PLUGINSDIR/inetc.dll

msvcrt

kernel32

user32

wininet

comctl32

generic

$PLUGINSDIR/md5dll.dll

generic

out.upx

generic

$PLUGINSDIR/modern-header.bmp

$PLUGINSDIR/nsDialogs.dll

kernel32

user32

gdi32

shell32

comdlg32

ole32

generic

$PLUGINSDIR/nsRandom.dll

generic

out.upx

generic